Experimental demonstration of a high speed quantum random number generation 
scheme based on measuring phase noise of a single mode laser 
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We present a high speed random number generation scheme based on measuring the quantum 
phase noise of a single mode diode laser operating at a low intensity level near the lasing threshold. 
A delayed self-heterodyning system has been developed to measure the random phase fluctuation. 
By actively stabilizing the phase of the fiber interferometer, a random number generation rate of 
500Mbit /s has been demonstrated and the generated random numbers have passed all the DIEHARD 
tests. 

PACS numbers: 03.67.Dd 



I. INTRODUCTION 

Random numbers have been widely used in many 
branches of science and technology, such as statistical 
analysis, computer simulation [1], cryptography [2], etc. 
One recent example is quantum key distribution (QKD) 
[3], where truly random numbers are required for both 
quantum state preparation and quantum state detection. 
Most recently, truly random numbers have also been em- 
ployed in testing fundamental principles of physics [4, 5]. 

In practice, it is not easy to obtain high quality ran- 
dom numbers with proven randomness [6]. In a crypto- 
graphic system, the application of a weak random num- 
ber generator (RND) could be catastrophic, as evidenced 
by Goldberg and Wagner's attack on the Netscape SSL 
implementation [7]. 

A pseudorandom generator generates a long train of 
"random" bits from a short random seed by employing 
deterministic algorithms. The generated long bit string 
could meet a number of statistical measures, which al- 
lows it to pass all existing randomness tests. However, 
the entropy of the long bit string is ultimately determined 
by the length of the random seed. In principle, random 
numbers generated by deterministic algorithms are not 
truly random. John von Neumann once famously said 
"Anyone who considers arithmetical methods of produc- 
ing random digits is, of course, in a state of sin." [8]. 

A physical RNG, on the other hand, generates random 
numbers from unpredictable physical processes, such as 
thermal noise [9], radioactive decay [10], air turbulence 
[11], etc. For example, the Intel 80802 Firmware Hub 
chip included a hardware random number generator [12]. 
It is important to distinguish two different types of phys- 
ical random number generation processes, based on the 
source of randomness: the chaotic behavior of classical 
deterministic systems, which we shall call type-one ran- 
domness henceforth; or the truly probabilistic nature of 
fundamental quantum processes [13], which we call type- 
two randomness. In this paper, we use the term "classical 
noise" to represent the unpredictability of a deterministic 
chaotic system and the term "quantum noise" to describe 



the fundamental uncertainty in a quantum process. 

For example, a RNG based on atmospheric conditions 
can be treated as a type-one RNG, since the randomness 
mainly originates from the absence of enough information 
about the weather system. In other words, the observed 
fluctuation can be treated as classical noise. Obviously, 
the more knowledge we have, the less random the system 
appears. The unpredictable weather change appeared to 
a layman might well be predictable to an expert equipped 
with supercomputers. This raises a serious question: how 
much can we trust a RNG? The weakness of a RNG could 
be fatal if the generated random numbers have been used 
as secure keys in a cryptographic system where the secu- 
rity relies on the true randomness of the key. 

We remark that ultrahigh speed RNGs based on 
chaotic semiconductor lasers have been proposed and 
random number generation rates above Gbit / s have been 
demonstrated [14]. In [14], random numbers are gener- 
ated from the amplitude noise of chaotic semiconductor 
lasers. However, as we discussed above, it is still arguable 
whether random numbers generated from a determinis- 
tic chaotic system are suitable for cryptographic applica- 
tions. 

Fortunately, a type-two RNG, or a quantum RNG 
(QRNG), can provide us with true random numbers with 
proven randomness. One of the simplest QRNG is con- 
structed by a single photon source, a symmetric beam 
splitter and two single photon detectors [13]. Each pho- 
ton has the same probability to be either transmitted or 
reflected by the beam splitter and thus "which detector 
clicks" is completely unpredictable. This unpredictabil- 
ity is not due to the absence of information about the 
quantum state of the photon or the measurement device, 
it is due to the probabilistic nature of a projection mea- 
surement. The randomness of the result is guaranteed by 
the fundamental laws of quantum mechanics. 

One natural source of quantum randomness is the ther- 
mal noise in an electrical amplifier [9]. However, a practi- 
cal high gain, broadband electrical amplifier also exhibits 
classical noises which typically dominate over the quan- 
tum noise. So far, the reported random number genera- 
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tion rate based on this scheme is only a few Mbit /s [9] . 

To date, most QRNGs are based on performing sin- 
gle photon detections [13, 15] and the highest random 
number generation rate achieved is 16 Mbit/s [16]. This 
random number generation rate is too low for certain 
applications, such as high speed QKD systems operated 
at GHz clock rates [17, 18]. Indeed, current high-speed 
QKD set-ups often use either a) deterministic random 
number generation algorithms or b) repeatedly a fixed 
pattern and, therefore, are not really unconditionally se- 
cure. Although there is still some room for improvement, 
the ultimate speed of these devices is limited by the per- 
formance of the single photon detector (SPD), such as its 
dead time, efficiency, afterpulsing probability, etc. For 
example, a typical silicon APD-SPD has a dead time of 
tens of ns [19], which suggests that the ultimate random 
number generation rate based on this type of SPD is in 
the order of tens of Mbit/s. 

Another promising quantum random number genera- 
tion scheme is based on measuring the random field fluc- 
tuation of vacuum with a homodyne detector [20]. How- 
ever, the fabrication of a high speed, shot noise limited 
homodyne detector is also a challenging task and a high 
speed QRNG (> tens of Mbit/s) based on this scheme 
has not been demonstrated. 

In this paper, we present a QRNG scheme based on 
measuring the quantum phase noise of a single mode 
semiconductor laser operating at a low intensity level 
near the lasing threshold [21]. This ensures that the main 
contribution to the phase noise is from spontaneous emis- 
sion (SE)[22], rather than from chaotic evolution of the 
macroscopic field [14] . One significant advantage of this 
scheme is the potential high random number generation 
rate. In this paper, we achieve a 500Mbit/s random num- 
ber generation rate with commercial off-the-shelf compo- 
nents. 

We remark that any practical devices present both 
quantum noise and classical noise, and true random num- 
bers can only originate from the former one. How can we 
distinguish these two different noises in practice? We will 
address this question briefly in Section V. 



well described by this model [25]. 

In [22], the dependence of the linewidth of a single 
mode semiconductor laser on its output laser power is 
described by 

^ " SttPo ^ ' 

Here, i/g is the group velocity, hv is the energy of photon, 
g is the gain of laser medium, rjsp is the spontaneous 
emission factor, Pq is the output power per facet. Um is 
the facet loss which is defined as a„i = g — a^, where a l 
is the waveguide loss of the laser, a = , where An' 
and An" are the deviations of the real part and imaginary 
part of the refractive index from their steady-state values. 

An intuitive physical picture is as follows [22]: each 
spontaneous emitted photon has a random phase, which 
in turn contributes a random phase fluctuation to the 
total electric field and results in a linewidth broadening. 
This is represented by the term "1" in the parentheses on 
the right hand side of (1). On the other hand, the same 
spontaneous emitted photon also alters the amplitude of 
the laser field, which results in a change of the carrier 
density. The change of carrier density further triggers a 
change of n", which is the imaginary part of the refractive 
index of the laser medium. Finally, the change in n" has 
an associated change of the real part of the refractive 
index n', which contributes to an additional phase shift of 
the laser field and linewidth broadening. This additional 
linewidth broadening is described by the term in the 
parentheses on the right hand side of (1). 

Note that the spontaneous emission is a quantum me- 
chanical effect and the corresponding phase noise can be 
treated as quantum noise. However, a practical laser 
source also presents additional classical noises, such as 
occupation fluctuation [26] and 1/f noise [27]. Fortu- 
nately, these classical noises arc laser power independent 
[26, 27]. By operating a semiconductor laser under cer- 
tain power level, the noise properties are mainly deter- 
mined by quantum effects [26] . In the following Sections 
we will show how to harness this quantum noise to gen- 
erate true random numbers. 



II. THEORETICAL MODEL 

A. Quantum phase noise and linewidth of 
semiconductor lasers 

The linewidth of a single mode semiconductor laser can 
be viewed as due to the random phase fluctuation of the 
optical field [22] . Experimental studies have shown that 
the linewidth of a single mode injection diode laser varies 
linearly with reciprocal laser output power [23, 24]. To 
explain these experimental discoveries, Henry developed 
a theoretical model which attributes the fundamental 
laser linewidth to the phase fluctuations arise from spon- 
taneous emission [22]. Furthermore, it has been shown 
that the phase noise of an InGaAsP DFB laser can be 



B. Phase measurement with a delayed 
self-heterodyning scheme 

The optical phase of a laser field can be measured 
by performing an interferometric experiment. A delayed 
self-heterodyning scheme has been employed to measure 
the linewidth of a semiconductor laser [24]. Fig.l shows 
its basic structure. 

The electric field of a laser beam can be described by 

E{t) = Eoexp[i{ojot + e{t))] (2) 

where 9{t) represents the random phase fluctuation of the 
laser source. 
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FIG. 1: The basic structure of a fiber based delayed self- 
lieterodyning system. AL is tfie patfi length imbalance; PD 
is a photo-detector. 



The interference signal detected by the photo detector 
(PD) can be described by 

S{t) oc \Eoexp[i{ujot+9{t+Tdj)]+Eoexp[i{u;ot+u;QTd+9{t))] 

(3) 

Here is the time delay difference between the two arms 
of the Mach-Zehnder interferometer (MZI), which can be 
determined by Td = nAL/C. AL is the path length 
imbalance, n is the refractive index of fiber and C is the 
speed of light in vacuum. 

After removing a DC background, equation (3) can be 
simplified as 



S{t)(xcos[LJoTd + A0{t,Td)] 



(4) 



where Ae{t, Td) = 9{t) - 9{t + Td). 

In (4), the term AO[t^Td) represents the quantum 
phase noise of the laser source, while the term uJoTd rep- 
resents the phase delay introduced by the path length dif- 
ference. In practice, for an interferometer without phase 
stabilization, the term LOoTd will not be a constant due 
to ambient temperature fluctuations, for example. This 
in turn will contribute additional classical phase noise. 
Intuitively, if the time delay difference Td is much larger 
than the coherence time of the laser, then A6'(t, Td) will 
present an uniform distribution in the range of [— tt, tt). 
Under this condition, the total phase uJoTd -I- A9{t,Td) 
also uniformly distributes in the range of [— tt, tt) regard- 
less of the actual value of cuoTd. Thus we can generate 
binary random numbers by simply measuring S(t) using 
a fast detector, sampling the output at the fixed intervals 
(Ts) to generate a series of S{ti), and taking the sign of 
the individual S{ti) in the series. 

A more rigorous discussion is as follows: the net contri- 
bution of a large number of SE photons can be character- 
ized by a random walk process, and the phase fluctuation 
A9{t, Td) can be treated as Gaussian white noise with a 
variance of [28]: 



{mt,Td)?) 



2Td 



(5) 



Here Tc is the coherence time of the laser, which is related 
to its linewidth A/ as Tc ~ [28]. 

Equation(5) shows that as long as Td ^ Tc, the result- 
ing Gaussian distribution can be treated as a uniform 
distribution in the range of [— tt, tt) in practice. 



It is useful to define two other time constants here. The 
response time of the photo-detection system Tr is defined 
as the reciprocal of the detection system's bandwidth. 
The sampling period Ts is defined as the reciprocal of 
the sampling rate. 

The necessary condition for random number genera- 
tion without phase stabilization is summarized as 



(6) 



From (6), the maximum sampling rate (or the random 
number generation rate) is determined by the coherence 
time of the laser. The coherence time of the laser used in 
our experiment can be set to a few ns by tuning its driv- 
2 ing current. To generate high quality random numbers, 
the sample period Ts should be larger than lOns, which 
corresponds to a maximum sample rate of lOOMHz. 

One way to go beyond the limitation imposed by the 
coherence time of the laser source is to employ phase 
stabilization technique. This can be seen from (4). By 
stabilizing the phase of the MZI, the term ujQTd in the 
cosine function can be treated as a constant. Further- 
more, if we can set uoTd = 2rm: -\- tt/2 (where m is an 
integral), equation (4) can be further simplified as 



S{t) 



i[A9{t, Td 



(7) 



Note in the derivation of (7), we have ignored the error 
of the phase feedback control system, which will con- 
tribute to additional classical noise. It will be interesting 
to quantify how the performance of the proposed RNG 
depends on the phase control error. 

From equation (7), the discrete time series samples of 
S{t), which is labeled as S{ti), has a symmetric distri- 
bution around zero. Again, we can generate binary ran- 
dom numbers by simply taking the sign of S(ti). Here, 
we don't need to assume that A9{t, Td) is uniformly dis- 
tributed in the range of [— tt, tt). In principle, the sam- 
pling rate is mainly limited by the bandwidth of the de- 
tection system but not the coherence time (or linewidth) 
of the laser. 

To minimize the correlation between adjacent samples, 
the time delay imbalance Td should be smaller than the 
sampling period Ts- This is illustrated in Fig. 2: sup- 
pose that the first sampling result S{ti) is determined 
by phase noise from the SE photons emitted in the time 
period of (ti — Td, ti), while the second sampling result 
5(^2) is determined by phase noise from the SE photons 
emitted in the time period of {t2 — Td, 12). By choosing 
Ts = t2-h> Td, S{ti) and S{t2) are contributed by SE 
photons emitted at different time windows, thus there is 
no correlation between them. 

In practice there are other factors to be considered on 
determining the optimal coherence time. On one hand, 
the coherence time should be larger than the response 
time Tji of the detection system. Otherwise, the interfer- 
ence signal will be averaged out due to its random fluc- 
tuation within the time period for acquiring one sample. 



4 















. ..> 














Time 



FIG. 2: The relation between the time delay imbalance Ta 
and the sampling period Ts- 



On the other hand, from (5), cannot be too large, oth- 
erwise, the variance of phase noise A9{t, Td) could be too 
small to be resolved. 

The necessary condition for random number genera- 
tion with phase stabilization is summarized as 
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FIG. 3: Experimental setup. I/-1550nm DFB diode laser; 
PCi, PC2-polarization controllers; PM-phase modulator; 
Ci,C2-fiber couplers; PZ)i-5GHz photo-detector for random 
number generation; PD2-IMHZ photo receiver for phase 
monitoring; Osc-3GHz real time oscilloscope; Comp-Desktop 
computer with a NI PCI6115 DAQ card; the length imbalance 
of the MZI is 650 ± 100 ps. 



IV. EXPERIMENTAL RESULTS 



Ts-Td> Tr (8) 



III. EXPERIMENTAL SETUP 

A 1.5 single mode cw DFB diode laser (ILX Light- 
wave) is employed as the source of quantum phase noise. 
From (1), the linewidth of the laser diode varies lin- 
early with reciprocal laser output power which can be 
conveniently controlled by adjusting the driving current. 
By operating the laser diode at a power level where its 
linewidth is much larger than the linewidth at the high 
power limit, the majority of the phase noise can be at- 
tributed to quantum noise. 

A delayed self-heterodyning system has been developed 
to measure the random phase fluctuation of the single 
mode DFB diode laser. The experimental setup is shown 
in Fig. 3. Two symmetric fiber couplers are used to con- 
struct a fiber MZI with a length imbalance of AL. The 
interference signals from the two output ports of the sec- 
ond fiber coupler are fed into two detection channels: 
the first channel, including a 5GHz bandwidth InGaAs 
photo-detector [PDi in Fig. 3) and a 3GHz bandwidth 
real time oscilloscope, is used to generate random num- 
bers; the second channel {PD2 in Fig. 3), which has a 
bandwidth of IMHZ, is used to monitor the relatively 
slow phase drift of the MZI due to ambient fluctuations. 
Due to its small bandwidth, PD2 can only sense the slow 
phase drift of MZI, while the high frequency phase fluc- 
tuation due to SE will be averaged out. The output from 
PD2 is sampled by a computer together with a DAQ card 
(NI PCI6115), which in turn provides a feedback control 
signal to a phase modulator inside the MZI. Two polar- 
ization controllers are used in this setup: PCi is used to 
make sure the polarization state of the input light aligned 
with the axis of the phase modulator, while PC2 is em- 
ployed to achieve high interference visibility. 



As we have discussed in Section II, by stabilizing the 
phase of MZI to satisfy the condition of LOtyTd = 2mn + 
7r/2 (where m is an integral), the sampling rate is not 
limited by the coherence time of the laser, so we can 
achieve a very high random number generation rate. 

During this experiment, the driving current of the DFB 
laser has been set to / = 12mA. Note, if the driving 
current is too small, the laser power will be too weak and 
the detected signal will be dominated by the noise of the 
detection system rather than the quantum phase noise of 
the laser; on the other hand, if the driving current is too 
large, the quantum phase fluctuation could be too small 
to be resolved. By using the technique described in [24], 
the coherence time Tc of the laser has been determined 
to be about 10ns (or a linewidth of 30MIIz) under the 
condition of / = 12mA and 320ns (or a linewidth of 
IMHz) at a high driving current (/ = 50mA). From (5), 
for a fixed Td, the phase noise variance is proportional 
to I/tc. Thus the phase noise variance at / = 12mA 
is about 32 times larger than that at / = 5QmA. Since 
we attribute the phase noise variance at the high power 
limit (or the high driving current) to classical noise and 
assume that it is laser power independent, we conclude 
that under our experimental conditions, the phase noise 
of the laser is dominated by quantum noise. 

For an ideal RNG, there is no correlation between its 
outputs at different times. From the correlation theorem 
in Fourier transformation, the spectrum of an ideal RNG 
is expected to be flat [29] . 

We have measured the noise spectrum of the setup 
shown in Fig. 3. In this experiment, a spectrum ana- 
lyzer (IIP8564E) has been employed to replace the os- 
cilloscope. Measurements have been performed with 
two different imbalanced MZIs, Tdi — 650 ± lOOps and 
Td2 = 250 ± lOOps. The measurement results are shown 
in Fig. 4. The electrical noise of the detection system has 
been measured by blocking the laser output. 

There are several remarkable features in Fig. 4. First 
of all, the electrical noise, which looks quite random in 
time domain, presents a few dominant spectral lines. 
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FIG. 4: Spectral power density of electrical and phase noise. 
The solid-line, dot-line and circle-line represent the spectral 
power densities of the detection system, the phase noise with 
a long delay {Td = 650 ± lOOps), and the phase noise with a 
short delay {Td = 250 ± lOOps), correspondingly. 



These spikes could be due to the environmental EM 
noises picked up by our detection system. This high- 
hghts the challenge in random number generation from 
the thermal noise of a broadband electrical amplifier: the 
residual classical noises could dominate over the quantum 
noise. On the other hand, the spectra of phase noise are 
broadband as expected. Secondly, the noise spectrum 
measured with a of 650 ± lOOps presents a clear low- 
pass character, while the noise spectrum measured with 
a smaller (250 ± lOOps) shows a flatter frequency re- 
sponse. As we have shown in Fig. 2, the measured phase 
noise is contributed by the SE photons emitted in a time 
interval of Td- This introduces an equivalent integration 
time in the order of Td and thus reduces the bandwidth 
of the whole system to l/Td- Third, at low frequency 
region, the noise power measured at Td = 250 ± lOOps is 
about 7dB lower than that at Td = 650 ± lOOps. This 
is consistent with (5), which suggests a linear relation 
between phase variance and the time delay Td- 

To generate random numbers, Td was set to be 650 ± 
lOOps and the output of PDl was sampled by the 3GHz 
oscilloscope at a sampling rate of IG samples per second 
(corresponding to Tg — Ins). The sampling results were 
saved onto the hard drive of the oscilloscope in frames: 
the oscilloscope continuously samples IM data, transfers 
the data into the hard drive and then starts to sample 
another frame of data. To generate binary random num- 
bers from the sampling results S{ti), we simply compare 
them with the mean value Sq: the ith bit is assigned as 
either "1" if S{U) > So or "0" if SiU) < So- 

Two lOOMbits binary random number trains have been 
generated, which are named as Binl and Bin2. By 
performing a bitwise XOR operation between Binl and 



FIG. 5: Autocorrelations of the random number trains ac- 
quired at IGbit/s. Note for Bin3, the equivalent random 
number generation rate is 500Mbit/s. 



Table 1 Diehard Test Results (500Mbits/s) 


Statistical Test 


P-Valuc 


Result 


BIRTHDAY SPAQKGS 


0.S4596S (KS) 


Success 


OVERL.APPIKG 5-PERML:TATI0N 


0.551420 


Success 


BINARY TEST for 3 1x31 matrices 


0.6+2062 


Success 


BINARY R.ANTC TEST for 32x32 matrices 


0_461672 


Success 


BINARY RASK TE ST for 6xS matrices 


0.607744 (KSO 


Success 


BITSTREAM 


0.SS9E7 


Success 


Ov" erlappin g -Pairs-Spars e-Oc c upan cy 


0.2373 


Success 


Ov" erlappin g -Quadruples- Sparse-0 c cupancy 


0.1S60 


Success 


DNA 


0.1435 


Success 


COUNT -THE-l's TEST 


0.919419 


Success 


COUNT-THE-l's TEST for specific bjtes 


0.751492 


Success 


P.4RKIKGL0T 


0.19945S (KS) 


Success 


^m^"T^■IL•M distance 


0.721783 (KS) 


Success 


3D SPHERES 


0.405683 (KS) 


Success 


SQEEZE 


0.3 05 844 


Success 


OVERLAPPING SU^fS 


0.246453 (KS) 


Success 


RUN'S 


0.829651 (KS) 


Success 


CRAPS 


0.S3S6S6 


Success 


KS; Kolmogorcfv-SBfliiDCfv TEST 



Bin2, the randomness can be further improved. This 
XOR operation has been commonly used on improving 
randomness of a RNG [6, 30]. The random number train 
generated through this XOR process is named as Bin3. 
Since Binl and Bin2 have been generated at 1Gbit /s, 
the equivalent generation rate of Bin3 is 500Mbit/s. 

To evaluate the qualities of these random numbers, we 
first calculated the autocorrelation of each random train. 
The results are shown in Fig. 5. From Fig. 5, we can see 
that the residual correlation of Bin3 is significantly lower 
than that of Binl. 

We further test the randomness of Bin3 with the 
DIEHARD test suite [31]. As shown in Table 1, BinS 
passed all the tests. 
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V. DISCUSSION AND CONCLUSION 

In this paper, we have presented a high speed ran- 
dom number generation scheme based on measuring tlic 
quantum phase noise of a DFB laser diode. The whole 
system is constructed with off-the-shelf components and 
a random number generation rate of 500Mbit /s has been 
demonstrated. Currently, the random number generation 
rate is mainly limited by the speeds of the oscilloscope 
(3GHz bandwidth) and the photo detector (5GHz band- 
width). By employing a detection/sampling system with 
a larger bandwidth and a higher sensitivity, we believe 
higher random number generation rate is achievable. 

Comparing with the random number generation 
scheme based on measuring vacuum noise [20], the 
scheme we proposed here is realized by interfering two 
relatively strong laser beams. The photo-detector does 
not have to be shot noise limited. So it is easier to im- 
plement. 

There are also similarities and differences between our 
scheme and the one reported in [14]. The SE con- 
tributes to both amplitude fluctuation and phase fluc- 
tuation. However, for a laser operated under normal 
conditions, it is very difficult to resolve the small am- 
plitude fluctuation due to SE. In [14], the authors oper- 
ated the lasers under chaotic conditions by introducing 
strong external feedbacks. The observed noise is mainly 
due to the chaotic behavior of the lasers rather than the 
quantum noise from SE. In contrast, the quantum phase 
fluctuation can readily be measured with a conventional 
interferometric setup, as we have shown in this paper. 

There is a lot of room to further improve the QRNG 
presented here. The sensitivity of the detection system 
can be further improved by replacing the photo detec- 
tor with a balanced detector followed by an electrical 
substraction circuit; the real time oscilloscope can be re- 
placed by either a high speed comparator or a high speed 
analogue to digital convertor; the DFB laser used in the 
current system could be replaced by a combination of a 
broadband light source and a narrowband optical filter. 
In this case, the coherence time (or linewidth) is deter- 
mined by the bandwidth of the filter. 

We would like to end this paper with some general 
comments on RNGs for secure communications. 

Typically, a true RNG consists of two components: a 
high entropy source and a randomness extractor [6] . The 
high entropy source could be a physical device whose out- 
put is more or less unpredictable, while the randomness 
extractor could be an algorithm which generates nearly 
perfect random numbers from the output of the high en- 
tropy source. For example, in the QRNG described in 
this paper, the combination of the laser source and the 
delayed self-heterodyning system can be treated as a high 



entropy source, while the bitwise XOR operation, which 
has been adopted to improve the randomness, can be 
treated as a randomness extractor. Note the randomness 
extractor normally generates a short, nearly perfect ran- 
dom number train from a long, imperfect one. Obviously, 
to design an appropriate randomness extractor, we need 
to know the entropy of the source in advance. 

The entropy of a practical device originates from both 
quantum noise and classical noise. As we have discussed 
in Section I, true random numbers with proven random- 
ness can only be generated from irreducible quantum ran- 
domness. Thus it is important to quantify with respect 
to the observed entropy, how much is contributed by the 
quantum noise. In [32], the authors proposed a scheme 
to quantify the "min-cntropy" (or the irreducible quan- 
tum entropy) of a two dimensional quantum system by 
employing quantum state tomography. This is an in- 
teresting idea. However, it does not take into account 
the classical noise contributed by the detection system. 
Moreover, it is not clear how to apply this idea to con- 
tinuous variables. 

Another interesting topic is how to deal with the finite 
response time Tr of a practical detection system. Nor- 
mally, we assume that the resulting correlation between 
adjacent samples drops exponentially when we increase 
the sampling period Tg. In practice, this correlation can 
be neglected by using a Ts much larger than Tr. How- 
ever, this will reduce the random number generation rate. 
To achieve the highest random number generation rate, 
it might be more efficient to tolerate a finite correlation 
at the sampling stage and let the randomness extractor 
to remove the residual correlation later on. 

Finally, in the special case of QKD, the randomness 
extractor might be integrated into the privacy amplifica- 
tion process. In QKD, after the quantum transmission 
stage, the two users need to perform error correction and 
privacy amplification (to correct errors and remove the 
eavesdropper's information) on the raw key to generate 
the final secure key. Since the data size of the raw key is 
much less than that of the random numbers used in the 
QKD experiment, it might be much efficient to treat the 
imperfection of the QRNG as partial information leaked 
to the eavesdropper, which can be removed during pri- 
vacy amplification. 

Wc arc thankful for enlightening discussions with Fei 
Ye and Amr S. Helmy. Support of the funding agen- 
cies CFI, CIPI, the CRC program, CIFAR, MITACS, 
NSERC, GIT, and Quantum Works is gratefully acknowl- 
edged. 

Notes Added: after the completion of a preliminary 
version of this paper, we notice that a preprint [33] has 
recently been posted on quant-ph. 
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